opencode-starterkit 1.0.1

package/baseline/skill/cloudflare/references/turnstile/configuration.md

@@ -0,0 +1,19 @@
+## Configuration Options
+
+### Widget Configurations
+```javascript
+{
+  sitekey: 'required',              // Your widget sitekey
+  action: 'optional-string',        // Custom action identifier for analytics
+  cData: 'optional-string',         // Custom data passed back in validation
+  callback: (token) => {},          // Success callback with token
+  'error-callback': (code) => {},   // Error callback
+  'expired-callback': () => {},     // Token expiry callback
+  'timeout-callback': () => {},     // Challenge timeout callback
+  'before-interactive-callback': () => {}, // Before showing checkbox
+  'after-interactive-callback': () => {},  // After checkbox interaction
+  theme: 'auto',                    // 'light', 'dark', 'auto'
+  size: 'normal',                   // 'normal', 'flexible', 'compact'
+  tabindex: 0,                      // Tab index for accessibility
+  'response-field': true,           // Create hidden input (default: true)
+  'response-field-name': 'cf-turnstile-response', /

package/baseline/skill/cloudflare/references/turnstile/gotchas.md

@@ -0,0 +1,27 @@
+## Troubleshooting
+
+### Widget Not Rendering
+- Check browser console for errors
+- Verify sitekey is correct
+- Ensure JavaScript is enabled
+- Check for CSP (Content Security Policy) blocking script
+- Verify not using `file://` protocol (only `http://` and `https://` work)
+
+### Validation Failing
+- Check secret key is correct
+- Verify token not expired (>5 min old)
+- Ensure token not already validated (single-use)
+- Check server can reach Siteverify API
+- Verify not using test secret key in production
+
+### CSP Configuration
+```html
+<meta http-equiv="Content-Security-Policy" 
+      content="script-src 'self' https://challenges.cloudflare.com; 
+               frame-src https://challenges.cloudflare.com;">
+```
+
+## Reference
+
+### Official Docs
+- [Turnstile Overview](https://developers.cloudflare

package/baseline/skill/cloudflare/references/turnstile/patterns.md

@@ -0,0 +1,41 @@
+## Common Pitfalls
+
+### ❌ Skipping Server-Side Validation
+```javascript
+// WRONG - Client-only, easily bypassed
+<form onsubmit="return window.turnstileToken ? true : false">
+```
+
+```javascript
+// CORRECT - Always validate server-side
+app.post('/submit', async (req, res) => {
+  const validation = await validateTurnstile(token, ip);
+  if (!validation.success) {
+    return res.status(400).json({ error: 'Invalid' });
+  }
+  // Process request
+});
+```
+
+### ❌ Exposing Secret Key
+```javascript
+// WRONG - Secret in client code
+const SECRET = 'your-secret-key';
+fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
+  body: JSON.stringify({ secret: SECRET, response: token })
+});
+```
+
+```javascript
+// CORRECT - Validation on server only
+// Client sends token to your backend
+// Backend validates with secret key
+```
+
+### ❌ Not Handling Token Expiry
+```javascript
+// WRONG - No expiry handling
+form.addEventListener('submit', (e) => {
+  e.preventDefault();
+  submitForm(turnstileToken);
+})